Tag Info

DNSSec is normal DNS, but with signatures. It absolutely prevents DNS Spoofing; that's what it's for, and that's what it does. Registrars can still theoretically abuse their position because they're responsible for communicating your intentions to the root servers. This includes information about your DNSSec keys. This relationship will never change; if ...

DNS Zone transfer is the process where a DNS server passes a copy of part of it's database (a zone) to another DNS server. It's how you can have more than one DNS server able to answer queries about a particular zone; there is a Master DNS server, and Slave DNS servers, and the slave asks he master for a copy of the records for that zone. A basic DNS Zone ...

Since DNS usually runs over UDP, response packets can be readily spoofed. UDP packets are identified by the combination of source and destination IP address and source and destination port numbers. The classic DNS poisoning attack is to send a DNS server a query which you think will cause the server to do a recursive lookup, and then blast away at the ...

If the victim is using an open wireless network, spoofing DNS is easy. It is easy for the attacker to mount a man-in-the-middle attack and send forged DNS responses. Therefore, if you are using an open wireless network, you should not trust DNS at all: it is trivial to spoof. Similarly, if the attacker is on the same subnet as you, spoofing DNS is easy: ...

Let's suppose that someone (Mario) wants to send an email to someone else (let's call him Nicolas). Nicolas' mailbox is filled by a unique server, let's say smtp.gouv.fr (that's a fictitious example). So, whatever Mario does, the email will have to go through that server, transmitted with the SMTP protocol (the one with the 'RCPT' command). Mario would like ...

This is very dangerous. If someone has control over your DNS they can, for example, steal all your email or your web traffic. First, do you operate your own DNS servers, or are they hosted (e.g. at a hosting provider or at your registrar)? Hosted: Check the control panel for these extra entries. They may be prepopulated to point to the host's servers. If ...

DNSSEC and DNSCurve address completely different aspects of DNS security. First of all, DNSSEC does NOT sign your queries. Rather DNSSEC allows a zone (such as a domain) to be signed by its owner, and allows a resolver (for instance, Comcast's DNS servers) to verify the signature, and therefore be sure that the zone data it gets is authentic. It protects ...

From looking at the source, I am going to wager that one potential reason is due to the fact that the user has the option to spoof the source IP address that is sending the malicious DNS requests and responses. If one was using the target name server to retrieve information, they would need to make requests from their true IP in order to receive responses. ...

We can but... At the point the query makes it to your server it's already too late. Your server will waste its resources trying to do something with the packets and the requests. Even if you have something like iptables drop all connections it's still going to use up all of the bandwidth on the server inbound. Redirecting all traffic someplace else eats up ...

In a technical sense, DNS is easy to spoof. It (almost always) uses UDP as the transport protocol, which is trivial to spoof compared to TCP. And DNS itself offers no precautions against spoofing, so if the attacker can return their own packet first, they win. Note that DNSSEC is designed to address this issue and a couple of others. Successful DNS ...

Can you tell who created the entries? Do you have access to edit your zone file? You might try checking those entries on the outside web and also internally. It could be an issue with your internal DNS server. If someone has access to create a ww or wwww then there is no reason that they can't redirect the real www address.

Blocking IP with no reverse DNS means punishing people who have bad ISP. It seems that most ISP have now understood that reverse DNS should be in place, but occasional mishaps still happen. There is no, to my knowledge, "legitimate" reason not to implement reverse DNS, but I have seen it happen a lot, and rejecting requests on that ground seems harsh, and ...

It depends on the device doing the NAT. Most sophisticated firewalls have fingerprint scrambling features that can be enabled, for example Checkpoint has had those features since NG I believe, so a good 10 years. A basic router will not do fingerprint scrambling, it will just use the source port in the TCP packet. Some few network devices will actually map ...

Obviously the implications are going to be implementation-dependent. The NAT device is free to choose any source port desired, and some implementations may have historically used sequential port numbering. But with newer hardware this is becomming increasingly unlikely. Specifically, newer routers prefer to use the client computer's original source port ...

ARP poisoning causes the traffic between those hosts to be forwarded through you, as part of the man in the middle attack. This causes performance degradation on the targets for a few reasons: There is increased latency due to the added network hop. Your network card has to send and receive 2 to 4 times as much data as normal, since you're acting as a ...

Despite what Wikipedia may say, they are not the same. Roughly speaking, DNS cache poisoning is one way to do DNS spoofing, but there are other ways to do it, too. DNS spoofing refers to the broad category of attacks that spoof DNS records. It is a category of attacks (an end goal of the attack, rather than a particular attack mechanism). There are many ...

The problem is that you need to drop the traffic before it reaches your network. So even when dropping packets at your server is way too late. The best way to reduce risk is to use packet scrubbing services like Akamai or Cloudfare who have DDoS mitigation techniques in place to prevent this traffic from reaching your network.

There are a lot of factors which play an important role in DNS poisoning but most probably the main one is timing. Using the same source port over and over again gives the attacker a huge time boost advantage, as he already knows the port he needs to send his queries to. If an attacker, with a rogue DNS server is able to reply to your request in a faster ...

I imagine there's a pretty big difference between what does happen and what should happen. Also, there's a decent amount of inconsistency in this behavior which depends (at least theoretically) on whether or not the server thinks it's supposed to be doing recursive queries. The "Additional Information" section is there to prevent (otherwise inevitable) ...

@GrahamHill already explained a zone transfer pretty good already, but I'll try to fill inn some more. By being able to query for all records from the DNS server, the attacker can easily determine which machines are accessible. The zone transfer may reveal network elements that is accessible from the Internet, but that a search engine like Google ...

Some ISPs have provide a service that redirects your browser to one of their search pages when you type a host name that doesn't exist in your browser. This relies on catching all DNS requests that wouldn't normally resolve and send one of their own IP addresses instead. Try typing the incorrect name in a web browser (from the network where you've found ...